1

I want to Windows Task Scheduler to start a custom task when a special event is logged to Windows Event Log. The event has EventID 6702 and when a data parameter is MyBackupJob. Here is my current custom trigger and it does not work:

<QueryList>
  <Query Id="0" Path="VisualSVNServerBackgroundJobs">
    <Select Path="VisualSVNServerBackgroundJobs">
            *[System[(EventID=6702)]] and *[EventData[Data[1]='MyBackupJob']]
    </Select>
  </Query>
</QueryList>

What's wrong?

Here is an example of the event from the log:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="VisualSVN Background Job Service" /> 
  <EventID Qualifiers="49152">6702</EventID> 
  <Level>2</Level> 
  <Task>0</Task> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2020-05-11T12:53:34.650971500Z" /> 
  <EventRecordID>4885</EventRecordID> 
  <Channel>VisualSVNServerBackgroundJobs</Channel> 
  <Computer>svn1.example.com</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data>{516B8AED-C3CF-4221-BC91-10B18BD3A56F}</Data> 
  <Data>MyBackupJob</Data> 
  <Data>{E3831378-33E1-4C8E-BE8A-CF08DB1CB7F0}</Data> 
  <Data>Failed to backup 1 out of 2 repositories.</Data> 
  <Data>00:00:00</Data> 
  <Data>203</Data> 
  </EventData>
  </Event>
bahrep
  • 29,961
  • 12
  • 103
  • 150

1 Answers1

1

Try changing

*[System[(EventID=6702)]] and *[EventData[Data[1]='MyBackupJob']]

to

//Event[EventData[Data[2]="MyBackupJob"]][System[EventID=6702]]

and see if it works.

Jack Fleeting
  • 24,385
  • 6
  • 23
  • 45
  • @bahrep Based on the sample log you posted, it's definitely `Data[2]`. Out of curiosity, what happens when you split the expression and use only `//Event[EventData[Data[2]="MyBackupJob"]]` or only `[System[EventID=6702]] `? – Jack Fleeting May 11 '20 at 14:46
  • Thank you! It works. However, I have to remove `//` from the suggested line. – bahrep May 11 '20 at 15:16
  • I overlooked that the task was actually running. Therefore, your suggestion is correct. – bahrep May 11 '20 at 15:17